Disclosure · Form 10-K · fiscal 2026
QDM International Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed June 29, 2026· period ended March 31, 2026· QDMI· CIK 1094032· Updated · filing on sec.gov ↗
QDM International Inc.'s Form 10-K for fiscal 2026, filed June 29, 2026, names the responsible offer as its top security role, reporting to the Chief Executive Officer.
What QDM International's Item 1C says
QDM International's Form 10-K for fiscal 2026 states that the company's "responsible offer" reports to the Chief Executive Officer periodically and on an as-needed basis to manage the risk assessment and mitigation process.
Who leads security
The responsible officer directly supervises employees' compliance with the company's internal safeguards.
How the company manages cyber risk
After risk assessments, the company evaluates whether and how to re-design, implement and maintain reasonable safeguards to mitigate identified risks and address gaps in existing safeguards. The company monitors and tests its safeguards and regularly conducts training for employees on these safeguards, in collaboration with human resources, IT, and management.
Third parties and incidents
The company states it has not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect it during the fiscal year ended March 31, 2026.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard. The section does not say how often the board or its committee is briefed on cybersecurity. The section does not mention outside assessors, consultants or auditors.
Read from the Form 10-K filed June 29, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
responsible offer
Reports to
Chief Executive Officer
“Our responsible offer is directly supervising our employees' compliance of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment and mitigation process.”
Board oversight
not identified
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2026.”
The section
510 words, Form 10-K filed June 29, 2026 for the period ended March 31, 2026
Read by claude-sonnet-5-5 on November 6, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns QDM International Inc. standard industrial classification 6411, Insurance agents, brokers & service (SEC SIC list). 5 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Roadzen Inc.FY 2026, filed June 29, 2026 | not identified | not identified | corporate governance committee |
| Willis Towers Watson plcFY 2025, filed February 25, 2026 | Chief Information Security Officer | Global Head of Technology | Risk and Operational Oversight Committee |
| Erie Indemnity CoFY 2025, filed February 23, 2026 | Chief Information Security Officer | not identified | Risk Committee |
| Arthur J. Gallagher & Co.FY 2025, filed February 17, 2026 | Chief Information Security Officer | CIO | Risk and Compliance Committee |
| Brown & BrownFY 2025, filed February 12, 2026 | chief information security officer | Company's chief security officer | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of QDM International Inc.'s Form 10-K as filed with the SEC on June 29, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Risk Management
We may face significant
and persistent cybersecurity risks due to the need to protect our business, our confidential information and information concerning our
personnel and others with whom we conduct business. As with other insurance brokerage companies, we occasionally face threats from actors
who seek to disrupt our business as well as others who are engaging in malicious activities for profit, to make a political point or for
no particular reason other than creating disruption. Disclosure of certain information as a result of a cybersecurity breach may result
in a breach of privacy laws. The substantial level of harm that could occur to us and our business partners and customers were we to suffer
impacts of a material cybersecurity incident; and our use of third-party products, services and components requires us to maintain robust
governance and oversight of these risks and to implement mechanisms, technologies and processes designed to help us assess, identify,
and eliminate these risks.
While we have not, as
of the date of this Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business
or operations, we cannot assure you that we will not experience such an incident in the future. Any cybersecurity incidents, whether or
not successful, could result in our incurring additional costs related to, for example, rebuilding our internal systems, implementing
additional threat protection measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access
to our computer systems, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.
We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their
occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our
products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our business partners
and our customers can be unaware of a threat or incident or its magnitude and effects. Further, there are increasing regulation requirements
regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and
reputational harm.
Governance
Following these risk
assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and
reasonably address any identified gaps in existing safeguards. Our responsible offer is directly supervising our employees' compliance
of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment
and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration
with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.
We have not encountered
cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our
business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2026.
Earlier filings on record
Fiscal 2025 Form 10-K, filed July 10, 2025 sec.gov ↗
Top security role, as the filing names it
responsible offer
Reports to, as the filing names it
Chief Executive Officer
“Our responsible offer is directly supervising our employees' compliance of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment and mitigation process.”
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2025 .”
Read by claude-sonnet-5-5 on November 6, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Risk Management
We may face significant
and persistent cybersecurity risks due to the need to protect our business, our confidential information and information concerning our
personnel and others with whom we conduct business. As with other insurance brokerage companies, we occasionally face threats from actors
who seek to disrupt our business as well as others who are engaging in malicious activities for profit, to make a political point or for
no particular reason other than creating disruption. Disclosure of certain information as a result of a cybersecurity breach may result
in a breach of privacy laws. The substantial level of harm that could occur to us and our business partners and customers were we to suffer
impacts of a material cybersecurity incident; and our use of third-party products, services and components requires us to maintain robust
governance and oversight of these risks and to implement mechanisms, technologies and processes designed to help us assess, identify,
and eliminate these risks.
While we have not, as
of the date of this Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business
or operations, we cannot assure you that we will not experience such an incident in the future. Any cybersecurity incidents, whether or
not successful, could result in our incurring additional costs related to, for example, rebuilding our internal systems, implementing
additional threat protection measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access
to our computer systems, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.
We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their
occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our
products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our business partners
and our customers can be unaware of a threat or incident or its magnitude and effects. Further, there are increasing regulation requirements
regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and
reputational harm.
Governance
Following these risk
assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and
reasonably address any identified gaps in existing safeguards. Our responsible offer is directly supervising our employees' compliance
of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment
and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration
with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.
We have not encountered
cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our
business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2025 .
Fiscal 2024 Form 10-K, filed July 1, 2024 sec.gov ↗
Top security role, as the filing names it
responsible offer
Reports to, as the filing names it
Chief Executive Officer
“Our responsible offer is directly supervising our employees' compliance of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment and mitigation process.”
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2024.”
Read by claude-sonnet-5-5 on November 6, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Risk Management
We may face significant
and persistent cybersecurity risks due to the need to protect our business, our confidential information and information concerning our
personnel and others with whom we conduct business. As with other insurance brokerage companies, we occasionally face threats from actors
who seek to disrupt our business as well as others who are engaging in malicious activities for profit, to make a political point or for
no particular reason other than creating disruption. Disclosure of certain information as a result of a cybersecurity breach may result
in a breach of privacy laws. The substantial level of harm that could occur to us and our business partners and customers were we to suffer
impacts of a material cybersecurity incident; and our use of third-party products, services and components requires us to maintain robust
governance and oversight of these risks and to implement mechanisms, technologies and processes designed to help us assess, identify,
and eliminate these risks.
While we have not, as of the date of this
Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, we cannot
assure you that we will not experience such an incident in the future. Any cybersecurity incidents, whether or not successful, could result
in our incurring additional costs related to, for example, rebuilding our internal systems, implementing additional threat protection
measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access to our computer systems, or
taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. We seek to detect and investigate
unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable
through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain
potentially vulnerable to known or unknown threats. In some instances, we, our business partners and our customers can be unaware of a
threat or incident or its magnitude and effects. Further, there are increasing regulation requirements regarding responses to cybersecurity
incidents, including reporting to regulators, which could subject us to additional liability and reputational harm.
Governance
Following these risk
assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and
reasonably address any identified gaps in existing safeguards. Our responsible offer is directly supervising our employees' compliance
of our internal safeguards and she reports to our Chief Executive Officer periodically and on an as-needed basis to manage our risk assessment
and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration
with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.
We have not encountered
cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our
business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2024.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.